Security
Security and data protection
What actually happens to your files on PuffinKit, how the website is protected, and where the limits are.
Security overview
PuffinKit’s tools that work with your files run in your browser. Your file isn’t uploaded, so there is no copy on a server to protect, leak or delete. The rest of this page explains how that works and how it is enforced.
Processed on your device
Both CSV tools read and change your file inside your browser. The file is not uploaded.
Network blocked while you work
The tool pages tell your browser to refuse every outgoing connection the page or its background worker tries to make.
HTTPS on every page
Pages travel to you encrypted, and browsers are told to use HTTPS only.
No tracking
No accounts, analytics, advertising, or third-party scripts.
What happens to each kind of data
| Data | Where it is | Who can see it | How long |
|---|---|---|---|
| File contents | Your browser tab’s memory, on your device | Only you. Not PuffinKit, not our host | Until you close or reload the tab |
| File details (name, size, row and column counts) | Your browser tab, used to show results and name the download | Only you | Until you close or reload the tab |
| Website request logs | Cloudflare, our hosting provider | Cloudflare, to deliver and protect the site. Logs show which pages were requested, never file contents | Set by our hosting provider (to be confirmed) |
| Saved templates and mappings | Your browser’s local storage, only if you press Save | Only you, on that device and browser | Until you delete them or clear site data |
| Contribution payments | Cashfree’s payment page (not puffinkit.com) | Cashfree processes card and bank details. We receive payment records such as amount, date, and the name and contact details you enter | Card/bank details: never held by PuffinKit. Payment records: to be confirmed |
Certifications
No certifications are listed yet. Each certification will appear here with its certificate number, issuing body, scope and validity dates, so that you can check it.
Data protection by design
The tools are built so that personal data in your files is never collected by PuffinKit in the first place. That is the strongest protection there is: data we never receive cannot be exposed by us.
How data-protection laws apply to the rest of the website, such as request logs, email and contributions, is described in the Privacy Policy.
How browser-local processing works
When you open CSV Import Error Repair or CSV Import Mapper & Converter, puffinkit.com sends your browser the tool’s code. From then on, everything happens on your device.
- You choose a file. Your browser reads it from your disk. Choosing a file does not send it anywhere.
- A background worker processes it. Parsing, checking and converting run in a Web Worker inside the same tab, so the page stays responsive.
- You review every change. Results are shown in the page, and nothing is changed without being listed.
- Your browser saves the result. The download is assembled in memory and handed to your browser’s normal download process.
Technical details
The file is read with the browser’s File API and transferred to a dedicated module Web Worker served from puffinkit.com. The worker parses it with a CSV parser bundled into the site’s own code, holds the data in memory and answers the page’s requests through message passing. The page and the worker each receive a Content Security Policy with connect-src 'none'.
Downloads are created with URL.createObjectURL on a Blob in memory, which is a local address that never leaves the browser. It is revoked shortly after the download starts. ZIP files are built in the worker by a bundled library.
Are files uploaded or stored on PuffinKit servers?
No. PuffinKit has no file upload, no file storage, and no server that processes files.
puffinkit.com is a set of static pages and scripts delivered by our hosting provider. There is no application server or database behind it, and no code that receives files. Your file name and file details are never put in a web address either, so they never appear in request logs.
The things that do stay behind are all on your own device, and only when you ask for them:
- a template or mapping you press Save on (see browser storage);
- files you download, including exported template or mapping files.
Future tools: the PDF tools listed as “coming soon” have not been built. Their processing method is shown as “to be confirmed”. If any future tool needs a server, its page and this one will say so before it launches, including what is sent, where and for how long.
HTTPS and transport security
Every page and script is served over HTTPS, so it is encrypted and protected from tampering between our hosting provider and your browser. Plain HTTP requests are redirected to HTTPS. The site sends a Strict-Transport-Security header, so a browser that has visited before uses HTTPS only, for a year.
HTTPS protects the code you run. That matters because the tools’ security depends on your browser running PuffinKit’s genuine code. Your files themselves don’t rely on HTTPS, because they are never transmitted. For the same reason we don’t call PuffinKit “end-to-end encrypted”.
Technical details
TLS is provided and certificates are managed by Cloudflare. The header sent is Strict-Transport-Security: max-age=31536000. It doesn’t include subdomains and the site is not on browsers’ preload list, so the very first visit relies on the HTTPS redirect.
Content Security Policy and browser protections
Every response carries security headers that tell your browser what the page is allowed to do. These are set for the whole site and checked by automated tests before each release.
| Header | Value | What it does |
|---|---|---|
| Content-Security-Policy (tool pages) | connect-src 'none' | Blocks fetch, XHR, WebSocket, EventSource and beacon requests from the page. |
| Content-Security-Policy (tool workers) | connect-src 'none' | The same block for the background worker that processes your file. |
| Content-Security-Policy (all pages) | script-src 'self' 'unsafe-inline' | Scripts may only come from puffinkit.com. Third-party scripts are refused. |
| Content-Security-Policy (all pages) | object-src 'none'; base-uri 'self'; form-action 'self' | No plugins, no rewriting of link targets, and forms can only submit to puffinkit.com. |
| Content-Security-Policy + X-Frame-Options | frame-ancestors 'none' · DENY | Other sites cannot embed PuffinKit in a frame (protects against click-jacking). |
| Strict-Transport-Security | max-age=31536000 | Browsers that have visited use only HTTPS for puffinkit.com for a year. |
| Cross-Origin-Opener-Policy | same-origin | Pages opened from other sites cannot reach into a PuffinKit window. |
| X-Content-Type-Options | nosniff | Browsers must treat each file as the type we declare. |
| Referrer-Policy | strict-origin-when-cross-origin | Links to other sites reveal at most “puffinkit.com”, never the page address. |
| Permissions-Policy | camera=(), microphone=(), geolocation=(), payment=(), usb=() | The site cannot ask for your camera, microphone, location, payment or USB devices. |
What these protections don’t cover
connect-src 'none' blocks programmatic network requests. It does not block navigation, links or loading images. It is a safety net behind the main guarantee, which is that the tools’ code never sends your data in the first place.
'unsafe-inline' is allowed for scripts because the site framework uses a small inline loader. External scripts from other sites are still refused.
Headers protect the website. They can’t protect against malware or untrusted extensions on your own device.
Data retention and browser storage
Your files: kept only in the tab’s memory and gone when you close or reload the tab. PuffinKit has no copy to retain.
Browser storage: PuffinKit sets no cookies of its own. It writes to your browser’s local storage only when you press Save:
- CSV Import Error Repair saves your import template: column names, types, rules and any allowed values you entered.
- CSV Import Mapper & Converter saves up to 50 mappings: column names, destination and conversion settings. For fields with a fixed set of values (such as yes/no), it also keeps the value translations you chose, for example “Y → yes”. It never saves rows.
You can delete these in the tool, or by clearing this site’s data in your browser’s settings. In a private window, browsers delete them when the window closes.
Request logs: our hosting provider processes standard request information, such as IP address, browser type and the page requested, to deliver and protect the site. How long it is kept is set byCloudflare and will be confirmed in the Privacy Policy.
Third-party services and payment providers
Cloudflare: hosting
Serves the website and protects it from abuse. Receives standard request information, but never your files. Cloudflare privacy policy
Cashfree Payments: optional contributions
If you choose to support PuffinKit, you pay on Cashfree’s own page. Cashfree handles your card or bank details; PuffinKit never sees them. We receive payment records such as the amount, date, and the name and contact details you enter. Cashfree privacy policy
That is the complete list. PuffinKit doesn’t use analytics, advertising, social-media widgets, embedded reviews, external fonts or third-party script libraries. Fonts and code are served from puffinkit.com. Links to other sites, such as platform help pages, are ordinary links that you choose to follow.
File-processing integrity and limitations
A tool that silently changes data is a risk in itself, so the CSV tools are built to protect the integrity of your data:
- Nothing changes silently. Every change is listed for you to review, and you can undo it before downloading.
- Unclear sections are held, not guessed. If part of a file can’t be read with certainty, it is set aside for you to decide on.
- Exact export by default. Values you didn’t change are written back exactly as they were, including identifiers, leading zeros, Unicode and multi-line text.
- Regression-tested. Each release is checked against a fixed set of sample files whose expected output must not change.
Limitations
- File size depends on your device. Processing happens in your device’s memory, so the limit is 50 MB on computers, 15 MB on phones and tablets that report their memory, 10 MB on those that don’t, and 8 MB on devices with 2 GB of memory or less.
- Closing the tab loses unsaved work, and we can’t recover it, because we never had it.
- Files are not virus-scanned. CSV files are plain text and the tools never run anything inside them. Treat files from unknown sources with care in other software.
- Your device is part of the picture. Browser extensions can read any page you open, including the tools. On a shared computer, delete downloads and saved templates when you finish.
- Check results before importing. The tools help you prepare a file. The system you import into has the final say on what it accepts.
Security of downloaded files
Downloads are created on your device and saved by your browser like any other download. They are never placed on a server, so there is no download link someone else could find.
Formulas in spreadsheets: a value starting with =, +, - or @ can run as a formula when a CSV is opened in Excel or Google Sheets. This is known as CSV or formula injection. Both tools offer a Spreadsheet-safe download option that adds an apostrophe in front of such values so they can’t run, and CSV Import Error Repair tells you how many values it would change. It is off by default because it changes those values, including phone numbers like +44…, which would break an import.
Once downloaded, the file is yours to protect. Store it as carefully as the original, especially if it contains personal data.
Reporting a vulnerability
If you believe you have found a security problem on puffinkit.com, please tell us privately at Contact email to be added before launch. Please include:
- the page or tool affected, and what an attacker could do;
- steps to reproduce it, using test data rather than real personal data.
Please don’t:
- access or change other people’s data;
- run denial-of-service or automated high-volume tests;
- use social engineering.
We read every report, will work with you to understand it, and will fix confirmed problems. PuffinKit doesn’t currently run a paid bug-bounty programme.
Security FAQs
Does PuffinKit upload my files?
No. CSV Import Error Repair and CSV Import Mapper & Converter process files entirely in your browser. The file is never sent to PuffinKit or anyone else, and the tool pages block outgoing network connections while you work.
Can PuffinKit staff see my data?
No. Because the file never leaves your device, there is nothing on our side to look at. Our hosting provider’s request logs show which pages were loaded, not what you did with a file.
What happens to my file when I close the tab?
It is gone. The file only ever exists in the tab’s memory. Only a template or mapping you chose to save stays in this browser, and it holds column settings, not your rows.
Is it safe to use with customer or personal data?
The tools are designed for exactly that: your data stays on your device. Use a device and browser you trust, because browser extensions can read web pages, and store the downloaded file as carefully as the original.
Is HTTPS the same as end-to-end encryption?
No. HTTPS encrypts pages on their way from our host to your browser. We don’t describe PuffinKit as end-to-end encrypted, because your files are not transmitted at all.
Does PuffinKit use cookies or tracking?
PuffinKit sets no cookies of its own and uses no analytics, advertising or tracking. See the Cookie Policy for what our hosting provider may set.
Who handles my payment if I support PuffinKit?
Cashfree Payments, on its own payment page. PuffinKit never sees or stores your card or bank details.
Will future PDF tools work the same way?
Not decided yet. Each upcoming tool shows its processing method as “to be confirmed”. Before any tool launches, its page and this Security page will say exactly where files are processed and whether anything is kept.